@pnpm/fetching.tarball-fetcher 1102.1.0 → 1102.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +21 -0
  2. package/lib/errorTypes/BadTarballError.js +2 -2
  3. package/lib/remoteTarballFetcher.js +14 -2
  4. package/package.json +9 -9
package/CHANGELOG.md CHANGED
@@ -1,5 +1,26 @@
1
1
  # @pnpm/tarball-fetcher
2
2
 
3
+ ## 1102.1.2
4
+
5
+ ### Patch Changes
6
+
7
+ - Updated dependencies:
8
+ - @pnpm/exec.prepare-package@1100.0.36
9
+ - @pnpm/fs.graceful-fs@1100.2.1
10
+
11
+ ## 1102.1.1
12
+
13
+ ### Patch Changes
14
+
15
+ - Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper` [pnpm/pnpm#14334](https://github.com/pnpm/pnpm/issues/14334).
16
+
17
+ - Network and archive retry logs hide credentials and signed query parameters in request URLs.
18
+
19
+ - Updated dependencies:
20
+ - @pnpm/error@1100.1.4
21
+ - @pnpm/exec.prepare-package@1100.0.35
22
+ - @pnpm/store.index@1100.3.1
23
+
3
24
  ## 1102.1.0
4
25
 
5
26
  ### Minor Changes
package/lib/errorTypes/BadTarballError.js CHANGED
@@ -1,9 +1,9 @@
1
- import { PnpmError } from '@pnpm/error';
1
+ import { PnpmError, redactUrlForDisplay } from '@pnpm/error';
2
2
  export class BadTarballError extends PnpmError {
3
3
  expectedSize;
4
4
  receivedSize;
5
5
  constructor(opts) {
6
- const message = `Actual size (${opts.receivedSize}) of tarball (${opts.tarballUrl}) did not match the one specified in 'Content-Length' header (${opts.expectedSize})`;
6
+ const message = `Actual size (${opts.receivedSize}) of tarball (${redactUrlForDisplay(opts.tarballUrl)}) did not match the one specified in 'Content-Length' header (${opts.expectedSize})`;
7
7
  super('BAD_TARBALL_SIZE', message, {
8
8
  attempts: opts?.attempts,
9
9
  });
package/lib/remoteTarballFetcher.js CHANGED
@@ -1,3 +1,4 @@
1
+ import { isIP } from 'node:net';
1
2
  import util from 'node:util';
2
3
  import { requestRetryLogger } from '@pnpm/core-loggers';
3
4
  import { FetchError, redactUrlForDisplay } from '@pnpm/error';
@@ -17,7 +18,7 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
17
18
  };
18
19
  const fetchMinSpeedKiBps = gotOpts.fetchMinSpeedKiBps ?? 50; // 50 KiB/s
19
20
  return async function download(url, opts) {
20
- const authHeaderValue = opts.getAuthHeaderByURI(url, { pkgName: opts.pkg?.name });
21
+ const authHeaderValue = getSecureNodeMirrorAuthHeader(opts.getAuthHeaderByURI(url, { pkgName: opts.pkg?.name }), url, opts.appendManifest?.name);
21
22
  const downloadRetryOpts = { ...retryOpts, ...opts.retry };
22
23
  const op = retry.operation(downloadRetryOpts);
23
24
  return new Promise((resolve, reject) => {
@@ -61,7 +62,7 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
61
62
  maxRetries: downloadRetryOpts.retries,
62
63
  method: 'GET',
63
64
  timeout,
64
- url,
65
+ url: redactUrlForDisplay(url),
65
66
  });
66
67
  }
67
68
  });
@@ -173,6 +174,17 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
173
174
  }
174
175
  };
175
176
  }
177
+ function getSecureNodeMirrorAuthHeader(authHeaderValue, url, appendedPackageName) {
178
+ if (authHeaderValue == null || appendedPackageName !== 'node')
179
+ return authHeaderValue;
180
+ const parsed = new URL(url);
181
+ if (parsed.protocol === 'https:' || isLoopbackHost(parsed.hostname))
182
+ return authHeaderValue;
183
+ return undefined;
184
+ }
185
+ function isLoopbackHost(hostname) {
186
+ return hostname === 'localhost' || hostname === '[::1]' || (isIP(hostname) === 4 && hostname.startsWith('127.'));
187
+ }
176
188
  // Per RFC 9110 §8.4, Content-Encoding is a comma-separated list of codings.
177
189
  // The response is encoded unless every coding is `identity` (case-insensitive,
178
190
  // surrounding whitespace ignored).
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@pnpm/fetching.tarball-fetcher",
3
- "version": "1102.1.0",
3
+ "version": "1102.1.2",
4
4
  "description": "Fetcher for packages hosted as tarballs",
5
5
  "keywords": [
6
6
  "pnpm",
@@ -30,13 +30,13 @@
30
30
  ],
31
31
  "dependencies": {
32
32
  "@pnpm/core-loggers": "1100.3.4",
33
- "@pnpm/error": "1100.1.3",
34
- "@pnpm/exec.prepare-package": "1100.0.34",
33
+ "@pnpm/error": "1100.1.4",
34
+ "@pnpm/exec.prepare-package": "1100.0.36",
35
35
  "@pnpm/fetching.fetcher-base": "1100.2.9",
36
36
  "@pnpm/fetching.types": "1100.0.3",
37
- "@pnpm/fs.graceful-fs": "1100.2.0",
37
+ "@pnpm/fs.graceful-fs": "1100.2.1",
38
38
  "@pnpm/fs.packlist": "1100.0.4",
39
- "@pnpm/store.index": "1100.3.0",
39
+ "@pnpm/store.index": "1100.3.1",
40
40
  "@pnpm/types": "1102.1.0",
41
41
  "@zkochan/retry": "^0.2.0",
42
42
  "lodash.throttle": "4.1.1",
@@ -44,15 +44,15 @@
44
44
  },
45
45
  "peerDependencies": {
46
46
  "@pnpm/logger": "^1100.0.0",
47
- "@pnpm/worker": "^1100.4.0"
47
+ "@pnpm/worker": "^1100.4.2"
48
48
  },
49
49
  "devDependencies": {
50
50
  "@jest/globals": "30.4.1",
51
- "@pnpm/fetching.tarball-fetcher": "1102.1.0",
51
+ "@pnpm/fetching.tarball-fetcher": "1102.1.2",
52
52
  "@pnpm/logger": "1100.0.0",
53
- "@pnpm/network.fetch": "1100.1.14",
53
+ "@pnpm/network.fetch": "1100.1.16",
54
54
  "@pnpm/store.cafs-types": "1100.1.0",
55
- "@pnpm/store.create-cafs-store": "1100.0.27",
55
+ "@pnpm/store.create-cafs-store": "1100.0.29",
56
56
  "@pnpm/test-fixtures": "1100.0.1",
57
57
  "@pnpm/text.ordinal-comparator": "1100.0.0",
58
58
  "@pnpm/types": "1102.1.0",